cisco smart install

[cyberops123]

does anyone familiar if Cisco routers support smart Install future ? if yes can you please let me know which models  

we are trying to make sure SMI future is disabled on cisco switches and not sure if routers support it as well .

Thanks

[Leo Laohoo]

Not all routers support Smart Install.
For a list of supported routers (Table 1), go HERE.

[cyberops123]

thanks for the share Leo  I can see that some of the 3900 routers are using SMI and thats what we have right now but I am looking for a command that I can use in CLI to verify it (like sh vstack status ) I couldnt see this in the article . 

and I guess SMI is  using port TCP 4786/4787 default and I might need to block those ports as well from outside .

[Leo Laohoo]

(Switch models as old as 2940/2950/2955, 3550 and EARLIER are not covered by this response.  I am not yet sure how the new Catalyst 9K behaves.)

I got some good news and some bad news.  

The GOOD news

The list of routers & switches that support Smart Install can be found HERE.  What is missing in the list are the 3650/3850 and 4500/6500 Supervisor cards.  This list is important.  

IF you have appliances found in this list, this means the only way to disable Smart Install is to use the command "no vstack" or "no vstack config".  

The BAD news (a really bad one)

If you have appliances (routers &/or Catalyst switches) not in this list, the ACL must be applied.  This is very important. 

[cyberops123]

Leo Thanks for your answer I have one more question with SMI

I just wanted to verify one of our cisco switches if SMI disabled and I am getting this output after issuing "show vstack config "

NFAP4507S01#sh vstack config
Role: Not Director (SmartInstall enabled)

I am little confused with this output if its actually enabled on our cisco switch ?

[Leo Laohoo]

---

@cyberops123 wrote:
Role: Not Director (SmartInstall enabled)

---

This means Smart Install is still enabled.  Use the command "no vstack" or "no vstack config" to disable Smart Install.

[cyberops123]

one last question how about this 3560 switch
it shows "Role : Client " does this model have it enabled too ?/


thanks for your quick respond

[Leo Laohoo · Accepted solution]

---

@cyberops123 wrote:
(SmartInstall enabled)

---

Whether the switch is an IBD or IBC, it doesn't matter.  The thing to look out for is the "enabled" portion.  If one is not using Smart Install then turn it off or the appliance will get "pwned".